public class OPRFHashToScalar
extends java.lang.Object
This implementation intentionally provides a *single* unified HashToScalar construction for all supported prime-order elliptic curve groups (P-256, P-384, P-521, Curve25519, Ristretto255, and Decaf448). Although RFC 9497 appears to specify different procedures for NIST curves and Edwards-family curves, these procedures are mathematically equivalent to one another and can be implemented using one common algorithm.
RFC 9497 defines HashToScalar as follows:
hash_to_field from RFC 9380 with modulus equal to the group
order.expand_message_xmd, interpret the output as an integer, and reduce it modulo the group
order.At first glance these appear to be fundamentally different algorithms. However, the use of hash_to_field for NIST curves is 100% equivalent to doing the same message_expansion_xmd operation described for other curves. That is:
uniform_bytes = expand_message_xmd(msg, DST, L) scalar = OS2IP(uniform_bytes) mod q
where L = ceil((log2(q) + k) / 8) and k is the security parameter for the
ciphersuite. This is precisely the construction used for the Edwards-family curves. In other
words, *both branches of RFC 9497 ultimately specify the same mathematical operation*.
Using a single generic implementation has several advantages:
For these reasons, this class implements the general form:
uniform_bytes = expand_message_xmd(msg, DST, L) scalar = OS2IP(uniform_bytes) mod group_order
This behavior is fully compliant with RFC 9497 and RFC 9380 and is applicable to all prime-order elliptic-curve groups.
| Constructor and Description |
|---|
OPRFHashToScalar(ECCurve curve,
Digest digest,
int k,
int s)
Constructs an instance of the OPRFHashToScalar class, which handles the process of encoding a
message into a scalar value based on the provided elliptic curve and digest algorithm.
|
OPRFHashToScalar(ECCurve curve,
ExtendedDigest digest,
int k)
Constructs an instance of the OPRFHashToScalar class, which handles the process of encoding a
message into a scalar value based on the provided elliptic curve and digest algorithm.
|
| Modifier and Type | Method and Description |
|---|---|
java.math.BigInteger |
process(byte[] input,
byte[] dst)
Hash the input message to a uniformly distributed scalar value on the elliptic curve.
|
public OPRFHashToScalar(ECCurve curve, Digest digest, int k, int s)
curve - the elliptic curve (ECCurve) used for the hashing processdigest - the digest algorithm (Digest) used for message hashing and expansionk - the security parameter affecting the size of hashed outputs - the input block size parameter for the cryptographic digest algorithmpublic OPRFHashToScalar(ECCurve curve, ExtendedDigest digest, int k)
curve - the elliptic curve (ECCurve) used for the hashing processdigest - the digest algorithm (Digest) used for message hashing and expansionk - the security parameter affecting the size of hashed outputpublic java.math.BigInteger process(byte[] input,
byte[] dst)
input - the input message as a byte arraydst - the domain separation tag as a byte array